Strategy to implement an 
integrated risk management 
framework in health Canada 


Ww 
ie) 
Nm 
= 
ite) 
w 
Ww 
= 
— 
= 
Se) 
= 
ise] 


: ae Sr) 


Bute 


* fe 
Sy heme i 


wie i 

Apel ere rsa Tie 
ik Es G 

genes 


Government 
Publications 


i* Health Santé 
Canada Canada 


STRATEGY TO IMPLEMENT AN 
INTEGRATED RISK MANAGEMENT FRAMEWORK 
IN HEALTH CANADA 


June 19, 2003 
Office of Integrated Risk Management 


Canada 


Our Mission is to help the people of Canada 
maintain and improve their health 
Health Canada 


This publication can also be made available in/on computer diskette/large print/ 
audio-cassette/Braille upon request. 


For further information or to obtain additional copies, please contact: 


Publications 

Health Canada 

Ottawa, Ontario K1A OK9 
Tel: (613) 954-5995 
Fax: (613) 941-5366 
E-Mail : info@hc-sc.gc.ca 


© Her Majesty the Queen in Right of Canada, 2004 
Cat. H21-232/2004E 

ISBN: 0-662-37165-08 

HC. Pub. No.: 1396 


Table of Contents 


FIRS OU LION Gon te cte crane on seem reper ates te a tet ewe son eter a oad s) ese) wy ete te! ate) © eh al abia sv 4 
OPERATING CONTEXE Feccreccts canis sca cote eee ee eratiphc. scree eke risuseecere: sider els) 4 
PROVIDING A FOCUS - IMPLEMENTING AN IRMF IN HEALTH CANADA ...... 6 
ANNEX A - ACTION PLAN: IMPLEMENTING AN INTEGRATED RISK 

MANAGEMENT FRAMEWORK IN HEALTH CANADA ................2.26. 13 
ANNEX B - INTEGRATING RISK MANAGEMENT WITH PLANNING CYCLE .... 21 
ANNEX C - INTEGRATING RISK MANAGEMENT IN 

HEALTH CANADA - ROLES AND RESPONSIBILITIES ................... 22 
ANNEX D - INTEGRATED RISK MANAGEMENT NETWORK ............... 23 


ANNE RE Ul gO REF REN CES ee ae eerie ee ee! sie) ieee a0! os wo Iefen ele 24 


Digitized by the Internet Archive 
in 2022 with funding from 
University of Toronto 


https://archive.org/details/31/61115561755 


Implementing a Risk Management Framework in Health Canada 


INTRODUCTION 


Organizations need a framework to manage and control significant risks that could 
interfere with achieving desired results and objectives. Managing risks is not new: 
it is fundamentally a good management practice. Mature risk management 
requires an organized and systematic approach to determine the best course of 
action under uncertainty. It is an essential part of good management and 
decision-making at all levels in the organization. 


This document describes the strategy for implementing an Integrated Risk 
Management Framework in Health Canada, including what immediate actions the 
Department intends to take over the next twelve to eighteen months to build a 
foundation towards mature risk management. These short-term actions are aimed 
at building commitment through communication, continuous learning and 
common understanding. 


What is Integrated Risk Management? 


“Risk” refers to the uncertainty that surrounds future events and outcomes. It is 
the level of exposure to uncertainties that an organization must understand and 
effectively manage. Risk is the expression of the likelihood of a future event 
occurring as well as its potential to influence the achievement of an organization’s 
objectives. 


If risk is about future uncertainty, then “Risk Management” is about making 
decisions involving uncertain future situations. Risk management is the 
systematic process - the practices and procedures - that an organization uses to 
manage the risks it faces. It is about setting a preferred course of action under 
uncertainty by identifying, assessing, understanding, acting on and 
communicating risk issues. 


“Integrated Risk Management” means incorporating risk information into the 
strategic direction-setting of the organization and making decisions that consider 
the department’s established risk tolerance levels. Integrated risk management is 
an organization-wide approach to managing risk at the strategic, operational and 
project level which is continuous, proactive and systematic. It is about applying 
sound risk management practices and fostering a working culture that values 
learning, innovation, responsible risk-taking and continuous improvement. 


OPERATING CONTEXT 

Government Wide Context 

The Privy Council Office, in 1998, convened a working group of assistant deputy 
ministers to consider horizontal issues associated with managing risk in the public 


policy process. The working group published a report in March 2000 
recommending, among other things, a government risk management framework. 
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Also in March 2000, the importance of strengthening risk management was 
reinforced by the tabling in Parliament of the document Results for Canadians: A 
Management Framework for the Government of Canada which contained a 
commitment to develop an integrated risk management framework. With the 
tabling of Results for Canadians, Modern Comptrollership became one of the 
government’s key priorities for modern management. Sound Risk Management is 
one of the pillars of Modern Comptrollership. 


In April 2001, the Treasury Board 
Secretariat (TBS) issued the Integrated 


Towards Management Excellence - Risk Management Framework (IRMF) to 
Elements of Modern Comptrollership: 


Strategic Leadership 
Motivated People 
Shared Values & Ethics 


address its commitment set out in 
Results for Canadians to strengthen 
management capabilities in departments 
and agencies. The IRMF identifies four 
elements to guide departments to 
manage risk and advance the 
development and implementation of 
modern management practices. It is 
important to note that in this context, 
risk is all encompassing and includes 
program risks of all sorts (e.g., financial, 
technology, property, health, etc.) An 
Implementation Guide (April 2003) has been developed as a companion document. 


Integrated Performance Information 
Mature Risk Management 
Rigourous Stewardship 

Clear Accountability 


Source: TBS April 2003 


The Clerk of the Privy Council has made the implementation of Modern 
Comptrollership one of his priorities. In addition, the Clerk made the 
implementation of Modern Comptrollership, including risk management, a key 
accountability commitment in the Deputy Ministers’ performance assessments. 


More recently, TBS introduced a 
comprehensive Management Management Accountability Framework 
Accountability Framework (MAF) - Indicators of Management Excellence - 
(draft document -June 2003) that 
defines and clarifies expectations 
of sound management. The MAF * Key risk identified and managed 
describes the key elements of * Risk lens in decision-making 
management excellence and ¢ Risk-smart culture 

responds to the criticism that * Capacity to communicate and manage 
there are too many “frameworks” risk 

by rationalizing the many existing Source: TBS June 2003 

TBS frameworks. Risk 
Management is one of the key 
management elements. 


Risk Management 


The MAF will be incorporated into the Deputy Ministers’ Guide on Accountability 
and will steer the government’s management agenda now and in the future. The 
Management Accountability Framework is aligned with the vision of Results for 
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Canadians and incorporates and builds on the principles of Modern 
Comptrollership. Ultimately, the MAF will be the basis for assessing the 
soundness of management practices in departments across the federal 
government. 


Health Canada Context 


As a pilot department for Modern Comptrollership, Health Canada committed to 
implementing modern management practices in the Department. As part of the 
management renewal process, the Department conducted, through a series of 
thirteen workshops and interviews, a self-assessment of current management 
practices to seek valuable opinions and perceptions of managers as they relate to 
recognized best practices and principles. Health Canada managers provided their 
full support and results from the self-assessment indicated excellent participation 
across the department from all levels of management. 


The self-assessment was completed 
in July 2001 and the findings tabled 
at the Departmental Executive 
Committee (DEC) in October 2001. 
The results identified a number of 
key findings where improvements 


Health Canada’s vision of Modern 
Comptrollership is an organization 
which focuses at every level, on the 
effective management of resources for 


were needed. In May 2002, the the achievement of results in a manner 
Departmental Executive Committee consistent with clearly defined and 
approved the document: A Modern commonly accepted values and ethics. 
Manag ement Strateg Y y Imp lementing Source: Health Canada’s Modem Management 
Modern Comptrollership in Health Strategy May 7, 2002 


Canada. The Strategy included a 
commitment “to implement an 
integrated risk management framework.” 


PROVIDING A FOCUS - IMPLEMENTING AN IRMF IN HEALTH CANADA 


IRM is a continuous, proactive and systematic process for understanding, 
managing and communicating risk from an organization-wide perspective. It is 
meant to support strategic decision-making that contributes to the achievement of 
an organization’s overall corporate objectives. 


In Health Canada risk management is an ongoing priority as it relates to health 
risks. The Department adopted in September 2000 the Decision-Making 
Framework (DMF) as a tool for risk management decision-making. The DMF is 
focused on health-related risk and has been applied primarily in the context of the 
Department’s DEC Sub-Committee on Risk Management which actively manages 
and provides overall leadership in health related risk activities. However, the 
scope of the IRMF is much broader. 
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Government of Canada’s 
Integrated Risk Management Framework 


. environmental scan 
. current status of risk 
. risk profile 


Corporate 
Risk Profile 


Establish 
an IRM 
Function 


. Management direction 

. communicate direction 
-operationalise integrated risk 
management through existing 
decision-making structures and 
reporting processes 


Practice 
Integrated 
Risk 
Management 


. common risk management 
process 

. decision-making and priority- 
setting 

. consultations with stakeholders 


. learning plans 
. best practices\case studies 


Continuous 
Learning 


Source: TBS April 2001 


TBS’ s Integrated Risk Management 
Framework is aimed at strengthening 
risk management practices within 
the Public Service. It 1s important to 
note that in this context, risk is all 
encompassing and includes program 
risks of all sorts (e.g., financial, 
technology, property, health, etc.). 
The Department recognizes that with 
respect to risk management there 
exist numerous organizational 
elements that are suitable to 
building an Integrated Risk 
Management Framework; for 
example: strategic & business 
planning, performance 
measurement, the DMF for health 
risks, modern comptrollership (risk 
management is one of the seven key 
elements), program evaluation, 
values and ethics, internal audit, 
accountability initiatives, quality 
assurance units, branch audit 
groups, technology risk framework, 
et al. 


Further, several Branches and Regions have already invested in risk management 


tools and techniques and a number have commenced the early stages of 


developing an IRMF. All Branches and Regions have appointed senior officers to 


lead this initiative and implement an IRMF for their respective organizations. 


Leadership and Coordination 


Senior Management also recognized the need for overall leadership and 
coordination to implement an Integrated Risk Management Framework for the 
Department. To that end the Departmental Executive Committee met in June 
2002 to discuss how best to move forward and at its October 2002 meeting, DEC 
made a number of decisions with respect to ongoing oversight and direction for the 
implementation of an IRMF. DEC recognizes that implementing an IRMF is a 
major undertaking and is committed to providing overall leadership. To provide a 
focus to the initiative, the Departmental Executive Committee agreed to the 


following: 
> DEC 

Retreats. 
>  DEC-PAC 


DEC has placed IRMF as a standing update item at its DEC- 


the Departmental Executive Sub-Committee on Policy and 


Analysis has been assigned the responsibility to direct and 
oversee the implementation of an Integrated Risk Management 
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Framework. 

>» Champion the ADM-CSB has been identified as the Champion for IRM to 
sustain the momentum to a risk-smart environment. 

» IRM Network all Branches, Regions and areas of functional expertise were 
directed by DEC to assign a senior official to create a Network 
responsible to take the necessary actions to implement an 
IRMF and act as lead for incorporating risk management in 
their respective organizations; 

>» Dept’! Lead the Director, Planning & Special Projects Directorate / Modern 
Comptrollership Office is the Department’s full time executive 
accountable to the ADM Corporate Services Branch for 
implementing the IRMF; chairs the Integrated Risk 
Management Network and manages the Office of Integrated 
Risk Management. The Director also manages the Office of 
Modern Comptrollership for the Department. An essential part 
of this role is to ensure that the implementation of an IRMF is 
consistent with Health Canada’s Modern Comptrollership 
initiative and the government’s new Management 
Accountability Framework. 

> Office of IRM _ the Department agreed to establish an Office of IRM, in the 
Planning and Special Projects Directorate; headed by a senior 

- project officer, the Office is tasked with developing and 
coordinating the IRMF implementation. An essential part of 
this task involves developing common terminology and 
identifying effective linkages with all other related initiatives 
and processes within the Department whether at the 
Corporate, Branch or Agency levels, such as corporate and 
business planning. The Office is to ensure that DEC Sub- 
Committees - specifically DEC-RM, DEC A&E, DEC-OPS, are 
informed of progress. The Office facilitates the implementation 
of the IRMF, functions as an expert resource and acts asa 
single window with Central Agencies and other government 
departments regarding IRM. 


With the evident amount of existing resources and work in progress by some 
Branches and Regions, DEC members directed that every effort should be made to 
build on existing investments. Specifically, DEC directed that a shared and 
common approach be applied. The OIRM and IRM Network would develop a 
departmental approach to ensure consistency and continuity. Branches and 
Regions are to incorporate risk management in their management frameworks and 
consistent with the departmental approach. 
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Linking IRM to the Planning Cycle 


The Departmental Executive Committee 
also agreed that risk management is an 
integral component of the department’s 
business cycle (Annex B) and that to 
assist in developing a corporate risk 
profile, the Office of Integrated Risk 
Management will work closely with the 
Department’s Horizontal Policy and 
Strategic Planning Division to ensure 
that risk management is incorporated 
in the environmental scan exercise 
leading to the establishment of the 
Department’s strategic priorities. This 


Risk Assessment Model for Decision-Making 


Likelihood: 


 — Extensive management essential 

[= Manage and monitor risk 

& = Monitor/Accept risk 

source: TBS IRMF April 2003 


will enable the department to start identifying areas of risk at the corporate level. 


AN ACTION PLAN - IRM Network Planning Retreat - May 6-7, 2003 


A Phased Approach 


Under the leadership of the Office of Integrated Risk Management, the IRM 
Network met for two days in early May 2003 to review, discuss and determine its 
approach to implementing an Integrated Risk Management Framework in Health 
Canada. As the implementation of an IRMF is a long-term initiative, the Network 
concluded that, consistent with TBS’s modern comptrollership model, Managing 
For Excellence, a phased approach is necessary: 


im a foundation phase that addresses the basic requirements of IRMF 


™ a transition phase that more fully integrates risk management 
™ a sustaining phase that is ongoing. 
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TOWARDS MANAGEMENT EXCELLENCE: COMPTROLLERSHIP PRACTICES 


MATURE RISK MANAGEMENT 


Definition: Strong risk management practices are integrated in strategic and operational decision- 
making in a manner that support innovation and sound stewardship. 


YY Foundation > 


Expected Practices 


Senior management recognizes the 
importance of an organization-wide 
approach to risk management and 
develops a corporate risk profile. 
Senior management ensures that the 
integrated modern management 
improvement agenda addresses all 
significant risks. Senior management 
ensures that all managers are aware of 
the corporate risk profile and include 
risk management in their individual 
learning plans. 


source: TBS - Modern Comptrollership 


Transition 


Expected Practices 


Senior management ensures that risk 
management is fully integrated in the 
strategic alignment of corporate 
resources, results and plans. Senior 
management makes sure that the 
accountability structure recognizes the 
importance of risk management and 
that external clients and stakeholders 
are adequately informed about the 
major risks facing the organization. 
Senior management promotes a culture 
where risk management is an integral 
part of the continuous learning and 
recognition programs. All managers 
understand and apply risk management 
practices in their decision-making. 


Towards Management Excellence 


The Guiding Principles : The 6 C’s 


Expected Practices 


Senior management and al] managers 
make results focused decisions 

informed by a solid risk management 
practices. Senior management ensures 
that nsk management is an integral part 
of the decision and knowledge tools and. | 
systems designed to support all 
employees. Senior management 

ensures that all employees understand 

the principles of risk management and 
apply them in their daily operations. 


April 2003 


To guide its work, the Integrated Risk Management Network agreed that it will 
build on what already exists at Health Canada and identified six principles - these 
are already being referred to as the Six Cs: 


> Commitment 

> Continuity 

> Consistency 

> Communication 

> Culture-conscious 


- visible senior management leadership; departmental 
management fosters an environment of support that 
encourages integrated management of risk; 

- a sustaining and ongoing management practice; risk 
management becomes an integral component of 


decision-making; 


- common strategy, practices, tools and techniques; 
- build awareness and understanding; significant 
decisions involving risk should be documented to 


support accountability; 


- develop effective strategies to implement risk 
management and gain momentum; all Branches / 
Regions are responsible to integrate risk management 
into their management frameworks; 
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> Continuous - maintaining and improving competencies - learning 
Learning from previous experiences; risk management to be 
incorporated as part of continuous learning 


As well, during the Planning Retreat members of the IRM Network discussed the 
benefits that the Department can anticipate by implementing an Integrated Risk 
Management Framework, including the following: 


> by managing risk, the Department can increase its certainty that its objectives 
will be met; 

> understanding risk improves decision-making and enhances awareness of risk 
at all levels in the organization; 

> a planned and proactive approach to managing and understanding risk assists 
in the identification of the Department’s strategic priorities; . 

> risks are identified and managed within the organization’s understanding of 
risk tolerance; 

>» clarifying and communicating organizational risk tolerance assists managers 
and employees in understanding the boundaries or limits within which they 
are expected to manage risk. 


The Action Plan 


The Planning Retreat focused on identifying actions for the short-term - the next 
twelve to eighteen months - to address the following seven key areas which the 
IRM Network deemed to be essential to building the foundation of an Integrated 
Risk Management Framework: 


Key Activities 


>» integrating risk management into existing decision-making processes 
> understanding risk tolerance 

assessing current risk management capacity 

communicating corporate direction for risk management 

shared leadership: roles and responsibilities 

>» risk management learning 

>» integrating risk management in the strategic priority setting exercise 


Vi ov, oy, 


Annex A presents the planned actions to address these key activities, including 
objectives and measures of success. The Network members have concluded that 
four of these key activities require concerted work and to this end, have 
established subgroups composed of Network members to address these key 
activities. These subgroups will report regularly to the Network through the OIRM. 
The OIRM will facilitate and coordinate the work of the Network and subgroups so 
that there is no duplication effort and that actions taken are complimentary. The 
overall measures of success for mature risk management were approved by the 
DEC as articulated in the Modern Management Strategy. 
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Monitoring & Reporting 


Ongoing monitoring and 
reporting on progress will 
ensure that Integrated Risk 
Management remains a 


Mature Risk Management - 
decision-making and monitoring processes 
based on identification and management of 


risk. 
priority in the Department’s 
modern management Success will be measured by: 
agenda. Periodic update ¢ risk management framework supported by 
reports on progress will be decision-makers and consistently used in 
presented to DEC-PAC by decision-making; 
the Office of Integrated Risk employee responsibilities and account- abilities 
Management. The Action for managing risk are well understood and 

followed. 


Plan identified in Annex A 
will be reviewed semi- 
annually and updated by the 
OIRM to reflect progress and 
further steps required for 
ongoing management renewal. Planned activities that require specific 
direction / decision will be tabled at DEC-PAC by the OIRM. 


Source: Health Canada’s Modern Management Strategy 


Treasury Board will be kept up-to-date on progress towards implementing an IRMF 
through the Department’s regular reports on implementing Modern 
Comptrollership. As well, the Departmental Lead will provide regular updates as 
member of TBS IRM Implementation Council. 


Branches/ Regions will regularly report on progress in implementing the IRMF in 
their respective areas and “best practices” will be identified and promoted across 
the department through the IRM Network. Regular updates on progress will be 
posted by the OIRM on the Health Canada website under “modern 
comptrollership”. Annually, the department will report on its plans and priorities, 
including IRMF, for modernizing comptrollership to Treasury Board, the Auditor 
General and Parliament through the Department’s Performance Report (DPR). 
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ANNEX A 


ACTION PLAN: IMPLEMENTING AN INTEGRATED RISK MANAGEMENT 
FRAMEWORK IN HEALTH CANADA 


A. Background 


This Action Plan consolidates the work of the IRM Network during the early part of 
2003, culminating at its two-day Planning Retreat in May. It is the general view of 
the IRM Network that in order to move forward on Integrated Risk Management, 
the Department needs to adopt a more systematic approach to the identification of 
risks at all levels of the organization. As the organization advances, the ongoing 
provision of guidance and structures (e.g. roles and responsibilities, operating 
principles, key terminology) will be important. Communicating about risk, 
strengthening competencies and providing tools for managing risk are seen as 
critical success factors. Continuous learning, by using case studies, best practices 
and sharing experiences and tools, is viewed as an integral part of Integrated Risk 
Management. 


The IRM Network deemed the following as “Key Activities” essential to building 
the foundation of an Integrated Risk Management Framework: 


integrating risk management into existing decision-making processes 
understanding risk tolerance 

assessing current risk management capacity 

communicating corporate direction for risk management 

shared leadership: identifying roles and responsibilities for integrating risk 
management 

>» risk management learning 

>» integrating risk management into departmental planning - profiling 
corporate risk 


\ fae A Sos iy A 


B. Overview of Action Plan 


The Action Plan is explicitly designed to address the four elements of an IRMF: 


Developing a Corporate Risk Profile 

Establishing an IRM Function 

Practicing IRM 

Ensuring Continuous Risk Management Learning. 


Vay oY 


In developing the Action Plan, the Departmental Office of IRM and the Network 
analyzed the TBS requirements in terms of managing for excellence; considered 
what other departments had done; and reviewed the observations in the Auditor 
General’s recent report regarding implementing risk management. 
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ANNEX A 


The Action Plan identifies the Key Activity, suggested measures of success, 
planned actions to address the key activity, who is responsible and planned target 
completion dates. The Action Plan will be updated semi-annually to reflect 
progress and appropriate actions as they unfold. 


The Network, as a whole, will collectively address three key activities and has 
established subgroups comprised of Network members to address the following: 
Understanding Risk Tolerance, Assess Current Risk Management Capacity, 
Communicate Corporate Direction for Risk Management, and Risk Management 
Learning. These sub-groups will have specific deliverables within each of these 
activities and will report on a regular basis to the Network through the OIRM. 


DEC-PAC will provide oversight for the Action Plan and progress reporting will be 


coordinated by the OIRM and posted on the Health Canada website under modern 
comptrollership. 
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ANNEX A 


C. Relationship of Action Plan - Key Activities to TBS Requirements 


The following chart illustrates the relationship of the Key Activities to TBS 


requirements. 


Relationship of Action Plan - Key Activities to TBS Requirements for 
Integrated Risk Management 


Elements 


Developing a 

Corporate | 
Risk 
Profile 


Establishing an 
Integrated | 


Managemer: 
Function _ 


__ Requirements _ 
. Environmental scanning 


. Identifying current status of risk 


. Establishing a risk profile 


. Senior management direction 
. Communicate management 


direction 


, Operationalise integrated risk mnegt 
thru existing decision-making & 
reporting structures 


. Assess capacity 


| .Common RM process applied at all 


levels 


. Decision-making and priority 
setting 


. Ongoing consultations 
w\stakeholders 


. Learning plans 


. Ongoing experience: 
- best practices 
- case studies 
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. Understanding Risk Tolerance 


. Integrating Risk in the Strategic Priority Setting 
Exercise 


. Integrating Risk Management within Existing 
Decision-Making Processes 


. Assess Current Risk Management Capacity 


. Communicate Corporate Direction for Risk 
Management 


. Shared Leadership : Roles and Responsibilities 


. Assess Current Risk Management Capacity 
. Understanding Risk Tolerance 


. Integrating Risk Management within Existing 
Decision-Making Processes 


. Risk Management Learning 
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Implemen tinga R 


isk Management Framework in Health Canada 


DM & 
Assoc. DM 


INTEGRATING RISK MANAGEMENT IN 


HEALTH CANADA - ROLES AND RESPONSIBILITIES 


(DRAFT....to be more fully defined / communicated by IRM Network as part of its action plan) 


ANNEX C 


IRM Governance IRM ADM's & He All Employees 
Structure Network RDG's 


* Sendmessage | * DEC-PAC - IRM Network - * Identify key risk * Contribute to * Participate in 
that IRM is a oversight for responsible to develop areas for their development of learning programs 
valuable IRMF and implement action plan respective risk tolerance about risk, apply 
discipline implementation | for IRMF, including organizations levels learnings and tools 

* Include IRM as to direct and communication, tools & * Develop and * Contribute to while ensuring 
ongoing sustain IRM methods, continuous provide clear organizational managers are 
commitment for * DEC-Retreats - | learning; comprised of direction on risk risk awareness advised of risk within 
all senior IRM is a senior representatives tolerance levels by identifying & the scope of their 
managers standing item from: * Incorporate risk raising risk work 

* Provide * Champion-to | ° all Branch & Regional management in issues to higher * Looking for opportun- 
direction on sustain the representatives are their levels ities for sensible risk 
IRM, including momentum \ their respective management * Be an agent of taking 
risk tolerance raise organization’s lead for frameworks change; * Report, respond to, 


* Assign roles for awareness IRM * Incorporation of understand and monitor & evaluate 
corporate IRM * Departmental * Areas of Expertise RM into communicate risks as required by 
governance Lead & Office include: respective organization’s respective manager \ 

* Regular report of IRM - -Strategic Planning business approach to IRM organization 
to TBS & OCG develop and (identifying corporate risk planning * Ensure * Request and 

* Include progress coordinate by incorporating risk * Ensure RM is employees are contribute by 
on IRM in DPR IRMF management in strategic incorporated into made available including RM in 
and RPP implementation | priority setting) key decision- for awareness personal learning 

; link RM to -Audit & making bodies and development plans 
the planning Accountability (annual & sessions 

cycle; lead multi-year audit plans * Put into practice 
development of | based on risk assessment the necessary 


of business lines) 
-Program Evaluation 


actions to support 
continuous RM 


corporate risk 
profile; ensure 


links to key (promoting performance learning 
DEC-sub- measurement that will 
committees - help managers focus on 
RM, A&E, Ops program results) 
* all DEC sub- -Quality Assurance 


(appropriate monitoring 
activities for early 
identification of risks) 
-Human Resources 
(learning, & training 
strategies) 
-Communications 
(corporate risk 
communications strategy) 


committees to 
incorporate risk 
management in 
decision- 

making 
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Implementing a Risk Management Framework in Health Canada 


ANNEX E 
LIST OF REFERENCES 


Health Canada: 

¢ Implementing Modern Comptrollership in Health Canada, A Modern Management Strategy, May 2002 

* Departmental Executive Sub-Committee on Risk Management - terms of reference 

¢ Departmental Executive Sub-Committee on Planning, Analysis and Communications - 
terms of reference 

* Integrated Risk Management Framework - Presentation to Departmental Executive 
Committee - June 28,2002 

* Summary Note IRM Network Plans retreat, May 6-7, 2003 

* Health Canada Website - modern comptrollership : 
http:/ /www.hc-sc.gce.ca/english/care/estimates/modern_comptrollership.htm 


Treasury Board of Canada: 

¢ Risk, Innovation and Values — Examining the Tensions — April 15, 1999 

* Integrated Risk Management Framework - April 2001 

¢ Management accountability Framework - Update Presentation - May 7, 2003 

* Results for Canadians: A Management Framework for the Government of Canada, tabled 
in Parliament by the President of the Treasury Board in March 2000 

* Risk Management Policy - Modified October 5, 2001 

¢ Best Practices in Risk Management: Private and Public Sectors - April 1999 

¢ Integrated Risk Management - Implementation Guide - April 2003 - Consultation Draft - 
Deo 

¢ Policy on Active Monitoring - Modified June 1, 2001 

¢ Modern Comptrollership Practices: Towards Management Excellence - April 7, 2003 

¢ Integrated Framework of Management Expectations plus associated indicators and 
measures - draft - May 2003 

¢ Integrated Risk Management Framework: A report on Implementation Progress - Final 
Draft - February 2003 

* Implementation Council for the Integrated Risk Management Framework - Terms of 
reference - June 2002 

* Integrated Risk Management - Implementation Guide - April 2003 - Consultation Draft 

¢ Risk Management Division website for extensive list of risk management websites inside 
and outside the federal government : http://www.tbs-sct.gc.ca/rm-gr/home- 
accueil.asp#M 


Privy Council Office: 
¢ Risk Management for Canada and Canadians - report of the ADM Working Group on Risk 
Management - March 2000 


The Canadian Centre for Management Development: 
* Foundation for Developing Risk Management Learning Strategies in the Public Service - 


CCMD Roundtable on Risk Management - April 2001 


Auditor General of Canada: 
* Report of the on Progress in Implementing IRM - April 2003 
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